[CART-003] Cart API: Backend integration for persistent cart

## Overview
Integrate the cart with a backend API so that cart state persists across devices and sessions for logged-in users. For guests, fall back to `localStorage`.

## Acceptance Criteria
- [ ] `POST /api/cart` — add item to server-side cart (authenticated)
- [ ] `PATCH /api/cart/:itemId` — update quantity
- [ ] `DELETE /api/cart/:itemId` — remove item
- [ ] `GET /api/cart` — fetch current cart on login
- [ ] On login, merge guest `localStorage` cart with server cart (prefer higher qty)
- [ ] Optimistic UI updates with error rollback

## ⚠️ Status: Blocked
This issue is currently **blocked** — the backend cart API has not been provisioned. The UI (#1) and state (#2) are complete; this ticket is the final integration step.

## Depends On
- #2 CART-002 — state management module must be complete
- Backend API service (external dependency, tracked separately)

## Blocks
- #9 Wishlist (needs cart pattern established)
- #11 Promotions engine (needs cart API to apply discounts)
- #14 Order service (reads cart to create orders)